Security
This page is deliberately specific. A ledger that touches a brokerage account should be able to say exactly where its limits are, and why they hold even if you do not take our word for it.
Where a broker separates reading from trading, Ledgepod asks for reading. Where it does not, the ledger never calls a trading endpoint — and the guide tells you plainly which brokers make that distinction and which do not, so you can decide.
Secrets are encrypted and tied to your user account on that computer. Copying the file to another computer gets an attacker nothing. Ledgepod never sees your broker password — you sign in at the broker.
Nothing can connect in. The app only acts on signed instructions it fetches itself, as the Terms describe.
Every release carries a publisher signature. The app verifies it on your machine and refuses anything that does not check out. An update that fails rolls itself back to the version that worked.
The files that decide what the app is allowed to do are encrypted and integrity-checked. If one is altered outside the app, the app pauses itself into a read-only state, tells you, and keeps your statements readable.
If you turn on reporting, what goes out is money and health figures under a username you choose. Account numbers, names, passwords and file paths are filtered out — and the app will show you the exact payload before it sends one.
The trust chain
Ledgepod checks its own entitlements the way a browser checks a certificate — through a chain that ends at a key that never touches our servers, not at a setting on your disk.
What you are entitled to, and for how long, comes only from a signed statement the app verifies. Editing a file on your own computer changes nothing.
The statement, its issue date and its validity window are on screen. If verification fails, the app says so rather than falling back to a guess.
Honest limits
It does not make a losing month a winning one — the ledger reports what your broker's records say, and nothing else. It cannot protect an account whose keys you have pasted somewhere else. It cannot recover a passport passphrase you have lost. And software this young has bugs in it; that is why every build is tested against a real ledger before anyone sees it, and why it is still in private testing.
If you find something wrong, we would rather hear it than not: [email protected].